App on a Cloud

This SME is a small start-up but is envisioning to be number 1 in its market, globally. It will need cloud service to do so, and as per different technical, business, risk mitigation and risk reasons it is working on architecting a hybrid ecosystem where several major as well as niche CSPs will be involved. However, all CSPs define their definitions and legal terms differently which makes it hard to create a clear landscape of what rights and obligation the SME has towards the respective CSP, and what rights and obligations it can arrange for with its own customers and end-users.

This SME is migrating its infrastructure to IaaS of a major CSP. Being a software company itself does not necessarily mean to have the necessary knowledge for migrating to the SaaS. And, to start with, in order to provide a good proposal and business model based on subscription fees this SME needs to know what kind of different duration period are applicable, and what the financial, technical and operational consequences are.

This use case is from an SME CSP that is quite advanced and knowledgeable about data access requests by authorities, and it is good to consider the do's and don’ts. Most CSPs do not know what to do if access to data is requested from a government authority and may give the government authority the wrong access without assessing such request. Generally, the scope of the formal requests to obtain access is too broad instead of a detailed scope, because the authority does not yet exactly know what kind of data they need to know. However, fishing by the government authorities is not allowed.

As per an above-average awareness level as per security breaches in its sector, being the financial services industry, this SME is quite concerned about keeping its data safe while also complying to current and upcoming regulation. With all the topics in the newspapers on security incidents, every SME should be keen on the management of those incidents, and this SME actually does. Besides that, new regulations such as the General Data Protection Regulation (GDPR) and the Network Information Security (NIS) Directive with daunting high penalties are a trigger as well.

A European SME who has formally used CRM SaaS to keep track of its customer relationship management and sales cycle would like to switch certain part of its data to another account in the same CRM SaaS, and – when that did not work out – to switch that data to another CSP. This in turn requires the ability to migrate data between different environments or providers. However, the former CRM SaaS did not specify anything on data portability, data format, what data would exactly be possible to migrate, and what not, or whether metadata would be part of that.

The Choice of law clause is a term of a contract in which parties specify that any dispute arising under the SLA shall be governed by in accordance with the laws of a particular jurisdiction. Since most of the major CSPs have headquarters in the United States of Americas, many of these CSP’s have designated the governing law of the state they have their headquarters applicable to the agreement. The SME has done diligence on what CSP would fit its SaaS and business ambitions best with regard to the provided IaaS. However, it did not notice the choice of law the SLA is governed by.

An SME has built its own SaaS on the PaaS infrastructure of a major CSP. The SME provides its SaaS to its customer under its own Master Service Agreement, Terms and Conditions and SLA. However, the SaaS SME did not notice that the PaaS CSP is contractually entitled right to unilaterally change the PaaS service offerings and conditions in the SLA, since the SME ticked the box while registering online without taking the time to assess the SLA and related terms. The CSP now invoked this right to lower the uptime and level of redundancy.

As there is so much to think about while choosing, selecting and procuring cloud services, and the SME is aware that carve-outs are part of the cloud SLA where the CSP further limits or excludes its responsibility and liability, it is not always the highest priority to assess, understand, discuss and negotiate these with the CSP. When an incident happens the CSP has defined the carve-out ‘force majeure’ very broad, in a way that all influences of third parties are excluded, even of those the CSP procures to be able to provide the cloud services.

The organisation decided to see how practical it would be to run the payroll process in the cloud. The existing payroll system was architected as a distributed application, so moving it to the cloud was relatively straightforward. The payroll application used an SQL database for processing employee data. Instead of rewriting the application to use a cloud database service, a VM with a database server was deployed. The database server retrieved data from a cloud storage system and constructed relational tables from it.

There are more than 1800 local governments across Japan, each of which has its own servers and IT sta . A secondary goal of the Kasumigaseki cloud is to provide a hybrid cloud environment. In addition to the Kasumigaseki cloud, the Japanese central government has decided to group local governments at the prefecture level. Each prefecture will have a private cloud and a connection to the Kasumigaseki hybrid cloud. Internal tasks and some data will be hosted in the prefecture’s private cloud, while other data will be stored locally.